I use an antimalware program- the scan finds a PUP (Potentially Unwanted Program), which is quarantined and removed. It comes back! I am guessing it is stored somehow to resurface after normal shut down and reboot. Where can this be hiding out? Someone suggested Google Drive? PUP's location in file says C User (my Wife) App Data Local Google Chrome User Data Default Extension then a string of random letters. It found this same instance 40 times of the same PUP on recent scan, but I thought this was taken care of when I first found this along time ago. I can find the same string of letters if I search verbatim in Google search. Google Forum said: I'd recommend running a scan on your computer with a trusted anti-virus software. If the scan detects any suspicious programs or applications, remove them immediately. Which is what I have done over and over..
Related question: Can Chrome sync be infected?
It sounds like the user is signed in to Chrome sync, which by default syncs extensions. Having an unwanted extension keep installing itself via the browser's Sync feature has happened to me and my users several times.
When your antivirus program removes the extension, Chrome Sync only sees that the extension isn't installed on that device, but it's still in your list of extensions in the cloud, so Sync re-installs the extension.
This might be difficult to fix, depending on the number of machines where the user has signed in to Chrome sync.
- On every machine where the user has Chrome Sync turned on, go to
chrome://settings/syncSetupand click "Turn off".
- On every machine where the user had Chrome Sync turned on, go to
chrome://extensions/and remove the extension.
- If you're not sure which one it is, I recommend removing all the extensions, just to be safe.
- If you really don't want to remove all of them, enter
chrome://extensions/?id=EXTENSIONIDin the address bar, where
EXTENSIONIDis the ID from the
%localappdata%\Google\Chrome\User Data\Default\Extensionsfolder you mentioned. That will bring up the specific extension, if it's still installed.
- Go to https://chrome.google.com/sync, scroll to the bottom, and click "Clear data."
- If desired, sign back in to Chrome sync.
If the program is in Google Chrome's User App Data folder, it is probably being downloaded as a temporary internet file. Every Time a user browses a website, the page is downloaded to that folder. So either your wife has downloaded multiple versions of a malicious file, or she keeps going to the same page to download the PUP. To eliminate the possibility there are just a lot of instances of the file, try deleting Google's entire folder in App Data and restarting the browser.
Other more advanced techniques could include a root kit, or a malicious version of chrome, but these are less likely.
The PUP being detected is a Chrome extension. It's not a temporary file.– user82155Mar 27, 2017 at 21:04
In that case having your antimalware software will only delete the file, chrome will redownload it. Try removing it from settings > extensions. Mar 27, 2017 at 21:31
So did it work? Mar 29, 2017 at 15:22
You need to find the infector file. You might have installed a shady desktop application or a chrome plugin.
I don't think that downvotes are warranted, this answer is short enough that yes, it could have been a comment, but at the same time it does give OP an educated guess as to what is most likely to have happened (aka a malicious extension that needs to be removed).– xoxelJan 25 at 12:32